Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`

A security bypass vulnerability was discovered in @angular/common when Server-Side Rendering SSR and hydration are enabled in applications using a hierarchical HttpClient configuration with withRequestsMadeViaParent. The HttpTransferCache utility optimizes hydration by caching outgoing HTTP...

CVE-2026-88059

A flaw was found in Angular. When Server-Side Rendering SSR and hydration are used with a hierarchical HttpClient configured with withRequestsMadeViaParent, the HttpTransferCache can improperly cache authenticated responses. This occurs because a child TransferCache stores private response data i...

CVE-2026-88059 Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.1, Angular's @angular/common HttpTransferCache can cache an authenticated response when Server-Side Rendering SSR and hydration u...

Linux Distros Unpatched Vulnerability : CVE-2026-53666

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied input to overwrite...

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Overview Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' in the deserializeErrors function during SSR hydration. An attacker can cause unexpected constructor execution on the client, potentially resulting in...

React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration

If application code allows attacker supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for attacker to trigger unexpected constructor execution on the client which would trigger outbound network traffic. This is only possible with very specific a...